CVE-2026-92761: WebVirtCloud Missing Authorization on Instance Control Actions
WebVirtCloud fails to properly validate permission flags in UserInstance grants, allowing view-only users to perform privileged actions. Attackers with read-only grants can power off virtual machines, reset root passwords, install SSH keys, and manage ISO images by exploiting the getinstance gate that only checks grant existence.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
WebVirtCloud users who have a UserInstance grant that provides view-only or read-only access to a virtual machine are exposed. Those users may be able to perform actions intended for more privileged users.
What access does an attacker need?
An attacker needs an existing read-only UserInstance grant for a target instance. No user interaction is required.
What actions could a read-only user perform?
A read-only user may be able to power off a virtual machine, reset its root password, install SSH keys, and manage ISO images.
How can administrators determine whether they are affected?
Review UserInstance grants and identify users assigned view-only or read-only access to instances. Those grants should be treated as capable of privileged instance-control actions until the authorization checks are corrected.